Breach Reporting Policy Template (ASIC | AFSL)

An AFS licensee must notify ASIC of a Reportable Situation within 30 days of first knowing, or being reckless as to whether, there are reasonable grounds to believe one has arisen. This template is a complete internal policy for getting there: how incidents reach the Compliance Officer, how significance is assessed, and how reports and records are made.

Use this policy if you:

• hold an Australian Financial Services Licence and provide financial services
• need a documented process for identifying, assessing and reporting breaches
• want internal deadlines that leave time to assess significance before the 30-day clock runs
• need a breach register that records incidents whether or not they are reported
• want your Compliance Officer and board to have defined roles in the process

It is suited to:

• AFSL holders with a Compliance Officer and a board of directors
• licensees acting as trustee or investment manager of managed investment schemes
• compliance teams documenting escalation and investigation timeframes
• boards reviewing Reportable Situations and rectification at their next meeting

What this policy covers:

• the types of Reportable Situation, from significant breaches of a Core Obligation to gross negligence and serious fraud
• the Core Obligations under sections 912A and 912B of the Corporations Act 2001 (Cth), and the parts of the Financial Services Law caught by section 912D(3)(b)
• the deemed significance tests, covering offence penalties, civil penalty provisions, misleading or deceptive conduct and material loss or damage
• the general significance assessment applied where no deemed test is met
• a four-step process: report to the Compliance Officer within 14 days of detection, determination within ten days, report to ASIC within 30 days, board review at the next meeting
• investigation handling, including escalation to the board after twenty-five days and the Investigation Reportable Situation that arises on the 31st day
• a key obligations table setting the timing and responsible person for each duty
• Schedule 1, a breach register covering reporting and detection dates, entities and fund or client affected, description and root cause, impact and level of risk, and corrective and preventative action

You receive an editable Word document with placeholders for [Client Name], the ACN and AFSL number, and the date the policy is approved by the board, together with a version history table and the Schedule 1 breach register. Sections 1 and 2 explain the regime and section 3 sets out the policy itself, so timeframes and role titles can be adjusted to match how your organisation operates. It is a starting point rather than advice on your licence conditions, so have it reviewed and tailored before you adopt it.